The boss of UK Biobank, Professor Sir Rory Collins, has stated that the recent data breach, which saw medical information from half a million participants listed for sale on a Chinese website, was caused by 'a few bad apples'.
Last week, the government revealed that datasets containing de-identified information about volunteers, which were made available to three academic institutions, were posted on Alibaba. Fortunately, the listings were removed quickly, and no purchases occurred.
In the aftermath, Sir Rory expressed his anger and distress over the incident, emphasizing that the institutions involved have been banned from the platform. The Biobank has decided to temporarily suspend access to its online research platform to put additional controls in place to prevent further breaches.
The UK Biobank collects health data from UK volunteers and has contributed to advancements in medical treatments and understandings, including dementia and cancer. The organization allows scientists from accredited academic institutions worldwide access to its datasets, which include various de-identified medical information.
In this case, a few bad apples have taken those data off the platform and they have listed the data for sale, Sir Rory explained during a broadcast on BBC Radio 4's Today program. He praised the swift actions taken by both the UK and Chinese governments in having the listings removed promptly.
Technological minister Ian Murray clarified in Parliament that the compromised datasets did not include participants' names or any direct contact information but could contain sensitive details such as age, gender, and biological sample measures. The Biobank has amassed in-depth medical information over the past two decades from participants aged between 40 and 69.
While Sir Rory acknowledged that no identification of individuals currently seems possible, he maintained that precautions are essential to ensure data is available for scientific endeavors while also protecting individuals’ rights.
In response to the breach, the UK Biobank has reported the incident to the Information Commissioner’s Office (ICO) for further investigation. The ICO has stated that organizations must responsibly handle personal medical data, as it is highly sensitive.
Sir Rory concluded by stating, UK Biobank has allowed discoveries to be made that otherwise would never have emerged about how to prevent and treat diseases like dementia. The balance is how do you put in place safeguards to allow that to go on, while doing it in a secure way.
}
